CVE-2025-26748: Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in looswebstudio Arkhe arkhe allows PHP Local File Inclusion.This issue affects Arkhe: from n/a through = 3.12.0...

Exploit for Cross-site Scripting in Ourphp

cve-2023-30212 PoC for CVE-2023-30212 using Docker CVE-2023-...

CVE-2025-32587: Improper Limitation of a Pathname to a Restricted Directory

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in pickupp WooCommerce Pickupp wc-pickupp allows PHP Local File Inclusion.This issue affects WooCommerce Pickupp: from n/a through = 2.4.3...

CVE-2025-30814: Improper Control of Filename for Include/Require Statement in PHP Program

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in RadiusTheme The Post Grid the-post-grid allows PHP Local File Inclusion.This issue affects The Post Grid: from n/a through = 7.7.17...

CVE-2024-8982

A Local File Inclusion LFI vulnerability in OpenLLM version 0.6.10 allows attackers to include files from the local server through the web application. This flaw could expose internal server files and potentially sensitive information such as configuration files, passwords, and other critical dat...

CVE-2024-8982: Path Traversal: '\..\filename'

A Local File Inclusion LFI vulnerability in OpenLLM version 0.6.10 allows attackers to include files from the local server through the web application. This flaw could expose internal server files and potentially sensitive information such as configuration files, passwords, and other critical dat...

PT-2025-12255

Name of the Vulnerable Software and Affected Versions OpenLLM version 0.6.10 Description A Local File Inclusion LFI flaw in OpenLLM allows attackers to include files from the local server through the web application, potentially exposing internal server files and sensitive information, such as...

CVE-2024-10986: Improper Link Resolution Before File Access

GPT Academic version 3.83 is vulnerable to a Local File Read LFI vulnerability through its HotReload function. This function can download and extract tar.gz files from arxiv.org. Despite implementing protections against path traversal, the application overlooks the Tarslip triggered by symlinks...

CVE-2025-29930

imFAQ is an advanced questions and answers management system for ImpressCMS. Prior to 1.0.1, if the $GET'seoOp' parameter is manipulated to include malicious input e.g., seoOp=php://filter/read=convert.base64-encode/resource=/var/www/html/config.php, the application could allow an attacker to rea...

PT-2025-11640

Name of the Vulnerable Software and Affected Versions imFAQ versions prior to 1.0.1 Description The issue allows an attacker to read sensitive files on the server through Local File Inclusion LFI by manipulating the seoOp parameter in the $ GET request. The seoOp and seoArg parameters are used...

PT-2025-11633

Name of the Vulnerable Software and Affected Versions Systemic Risk Value versions =2.8.0 Description The issue allows an unauthenticated attacker to exploit Local File Inclusion via the /GetFile.aspx?ReportUrl= endpoint. This can be done by supplying a crafted file path, potentially exposing...

CVE-2025-29930: External Control of File Name or Path

imFAQ is an advanced questions and answers management system for ImpressCMS. Prior to 1.0.1, if the $GET'seoOp' parameter is manipulated to include malicious input e.g., seoOp=php://filter/read=convert.base64-encode/resource=/var/www/html/config.php, the application could allow an attacker to rea...

PT-2025-11044

Summary A mock API configuration for static file serving following the same approach presented in the documentation page, where the server filename is generated via templating features from user input is vulnerable to Path Traversal and LFI, allowing an attacker to get any file in the mock server...

CVE-2025-26932: Improper Control of Filename for Include/Require Statement in PHP Program

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in QuantumCloud ChatBot chatbot allows PHP Local File Inclusion.This issue affects ChatBot: from n/a through = 6.3.5...

CVE-2024-8550

A Local File Inclusion LFI vulnerability exists in the /load-workflow endpoint of modelscope/agentscope version v0.0.4. This vulnerability allows an attacker to read arbitrary files from the server, including sensitive files such as API keys, by manipulating the filename parameter. The issue aris...

CVE-2024-8550: Exposure of Sensitive System Information to an Unauthorized Control Sphere

A Local File Inclusion LFI vulnerability exists in the /load-workflow endpoint of modelscope/agentscope version v0.0.4. This vulnerability allows an attacker to read arbitrary files from the server, including sensitive files such as API keys, by manipulating the filename parameter. The issue aris...

CVE-2025-0630: External Control of File Name or Path

Multiple Western Telematic WTI products contain a web interface that is vulnerable to a local file inclusion attack LFI, where any authenticated user has privileged access to files on the device's filesystem...

PT-2025-3853

Name of the Vulnerable Software and Affected Versions Jupiter X Core plugin for WordPress versions up to, and including, 4.8.7 Description The issue allows authenticated attackers, with Contributor-level access and above, to include and execute arbitrary files on the server, enabling the executio...

CVE-2025-24886: UNIX Symbolic Link (Symlink) Following

pwn.college is an education platform to learn about, and practice, core cybersecurity concepts in a hands-on fashion. Incorrect symlink checks on user specified dojos allows for users admin not required to perform an LFI from the CTFd container. When a user clones or updates repositories, a check...

CVE-2024-54663

An issue was discovered in the Webmail Classic UI in Zimbra Collaboration ZCS 9.0 and 10.0 and 10.1. A Local File Inclusion LFI vulnerability exists in the /h/rest endpoint, allowing authenticated remote attackers to include and access sensitive files in the WebRoot directory. Exploitation requir...